A poisoned package installed by a coding agent silently reads SSH keys, API tokens, and environment variables from the developer's machine and sends them to the attacker. This happened in a documented 2025 incident involving a compromised npm package automatically installed by AI coding agents.

A malicious MCP server impersonating a legitimate email service secretly BCC'd all outgoing emails to an attacker-controlled address — while the agent and user saw no indication anything was wrong. Every email sent through the agent was copied to the attacker.

Hidden instructions embedded in a tool's metadata caused an AI assistant to exfiltrate the user's private repository data when the tool was invoked — without any visible indication to the user that anything unusual was happening.

A compromised RAG plugin that fetches context from a third-party indexer can gradually bias an agent's responses by seeding the index with crafted entries — shifting the agent's outputs in ways that serve the attacker without any single action being obviously malicious.

A compromised prompt hub or proxy layer intercepts the agent's responses, exfiltrates data, and manipulates what the agent sends back — effectively acting as a man-in-the-middle between the agent and its outputs, with no indication to the user or operator.

A malicious component pushed through a shared registry, MCP server, or update channel can simultaneously compromise every agent deployment that trusts that source — turning a single supply chain compromise into a mass incident affecting thousands of users before the attack is detected.